@shipfox/api-runners 5.0.0 → 7.0.1

package/dist/db/schema/running-job-executions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/db/schema/running-job-executions.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {sql} from 'drizzle-orm';\nimport {check, index, text, timestamp, uuid} from 'drizzle-orm/pg-core';\nimport {pgTable} from './common.js';\nimport {runnerSessions} from './runner-sessions.js';\n\nexport const runningJobExecutions = pgTable(\n  'running_jobs',\n  {\n    id: uuidv7PrimaryKey(),\n    workspaceId: uuid('workspace_id').notNull(),\n    workflowRunId: uuid('workflow_run_id').notNull(),\n    workflowRunAttemptId: uuid('workflow_run_attempt_id').notNull(),\n    jobId: uuid('job_id').notNull(),\n    jobExecutionId: uuid('job_execution_id').notNull().unique(),\n    projectId: uuid('project_id').notNull(),\n    runnerSessionId: uuid('runner_session_id')\n      .notNull()\n      .references(() => runnerSessions.id),\n    provisionerId: uuid('provisioner_id'),\n    provisionedRunnerId: text('provisioned_runner_id'),\n    requiredLabels: text('required_labels').array().notNull(),\n    runnerLabels: text('runner_labels').array().notNull(),\n    startedAt: timestamp('started_at', {withTimezone: true}).notNull().defaultNow(),\n    firstHeartbeatAt: timestamp('first_heartbeat_at', {withTimezone: true}),\n    lastHeartbeatAt: timestamp('last_heartbeat_at', {withTimezone: true}).notNull().defaultNow(),\n    cancellationRequestedAt: timestamp('cancellation_requested_at', {withTimezone: true}),\n  },\n  (table) => [\n    index('runners_running_jobs_no_first_heartbeat_started_idx')\n      .on(table.startedAt)\n      .where(sql`\"first_heartbeat_at\" IS NULL`),\n    index('runners_running_jobs_last_heartbeat_at_idx').on(table.lastHeartbeatAt),\n    index('runners_running_jobs_provisioned_runner_started_idx')\n      .on(table.workspaceId, table.provisionerId, table.provisionedRunnerId, table.startedAt.desc())\n      .where(sql`\"provisioner_id\" IS NOT NULL`),\n    index('runners_running_jobs_cancellation_requested_idx')\n      .on(table.workspaceId, table.provisionerId, table.provisionedRunnerId)\n      .where(sql`\"cancellation_requested_at\" IS NOT NULL`),\n    index('runners_running_jobs_job_id_idx').on(table.jobId),\n    index('runners_running_jobs_runner_session_id_idx').on(table.runnerSessionId),\n    check(\n      'runners_running_jobs_link_ck',\n      sql`(${table.provisionerId} IS NULL) = (${table.provisionedRunnerId} IS NULL)`,\n    ),\n  ],\n);\n\nexport type RunningJobExecutionDb = typeof runningJobExecutions.$inferSelect;\nexport type RunningJobExecutionInsertDb = typeof runningJobExecutions.$inferInsert;\n"],"names":["uuidv7PrimaryKey","sql","check","index","text","timestamp","uuid","pgTable","runnerSessions","runningJobExecutions","id","workspaceId","notNull","workflowRunId","workflowRunAttemptId","jobId","jobExecutionId","unique","projectId","runnerSessionId","references","provisionerId","provisionedRunnerId","requiredLabels","array","runnerLabels","startedAt","withTimezone","defaultNow","firstHeartbeatAt","lastHeartbeatAt","cancellationRequestedAt","table","on","where","desc"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,GAAG,QAAO,cAAc;AAChC,SAAQC,KAAK,EAAEC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,IAAI,QAAO,sBAAsB;AACxE,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,cAAc,QAAO,uBAAuB;AAEpD,OAAO,MAAMC,uBAAuBF,QAClC,gBACA;IACEG,IAAIV;IACJW,aAAaL,KAAK,gBAAgBM,OAAO;IACzCC,eAAeP,KAAK,mBAAmBM,OAAO;IAC9CE,sBAAsBR,KAAK,2BAA2BM,OAAO;IAC7DG,OAAOT,KAAK,UAAUM,OAAO;IAC7BI,gBAAgBV,KAAK,oBAAoBM,OAAO,GAAGK,MAAM;IACzDC,WAAWZ,KAAK,cAAcM,OAAO;IACrCO,iBAAiBb,KAAK,qBACnBM,OAAO,GACPQ,UAAU,CAAC,IAAMZ,eAAeE,EAAE;IACrCW,eAAef,KAAK;IACpBgB,qBAAqBlB,KAAK;IAC1BmB,gBAAgBnB,KAAK,mBAAmBoB,KAAK,GAAGZ,OAAO;IACvDa,cAAcrB,KAAK,iBAAiBoB,KAAK,GAAGZ,OAAO;IACnDc,WAAWrB,UAAU,cAAc;QAACsB,cAAc;IAAI,GAAGf,OAAO,GAAGgB,UAAU;IAC7EC,kBAAkBxB,UAAU,sBAAsB;QAACsB,cAAc;IAAI;IACrEG,iBAAiBzB,UAAU,qBAAqB;QAACsB,cAAc;IAAI,GAAGf,OAAO,GAAGgB,UAAU;IAC1FG,yBAAyB1B,UAAU,6BAA6B;QAACsB,cAAc;IAAI;AACrF,GACA,CAACK,QAAU;QACT7B,MAAM,uDACH8B,EAAE,CAACD,MAAMN,SAAS,EAClBQ,KAAK,CAACjC,GAAG,CAAC,4BAA4B,CAAC;QAC1CE,MAAM,8CAA8C8B,EAAE,CAACD,MAAMF,eAAe;QAC5E3B,MAAM,uDACH8B,EAAE,CAACD,MAAMrB,WAAW,EAAEqB,MAAMX,aAAa,EAAEW,MAAMV,mBAAmB,EAAEU,MAAMN,SAAS,CAACS,IAAI,IAC1FD,KAAK,CAACjC,GAAG,CAAC,4BAA4B,CAAC;QAC1CE,MAAM,mDACH8B,EAAE,CAACD,MAAMrB,WAAW,EAAEqB,MAAMX,aAAa,EAAEW,MAAMV,mBAAmB,EACpEY,KAAK,CAACjC,GAAG,CAAC,uCAAuC,CAAC;QACrDE,MAAM,mCAAmC8B,EAAE,CAACD,MAAMjB,KAAK;QACvDZ,MAAM,8CAA8C8B,EAAE,CAACD,MAAMb,eAAe;QAC5EjB,MACE,gCACAD,GAAG,CAAC,CAAC,EAAE+B,MAAMX,aAAa,CAAC,aAAa,EAAEW,MAAMV,mBAAmB,CAAC,SAAS,CAAC;KAEjF,EACD"}
+{"version":3,"sources":["../../../src/db/schema/running-job-executions.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {sql} from 'drizzle-orm';\nimport {check, index, text, timestamp, uuid} from 'drizzle-orm/pg-core';\nimport {pgTable} from './common.js';\nimport {runnerSessions} from './runner-sessions.js';\n\nexport const runningJobExecutions = pgTable(\n  'running_jobs',\n  {\n    id: uuidv7PrimaryKey(),\n    workspaceId: uuid('workspace_id').notNull(),\n    workflowRunId: uuid('workflow_run_id').notNull(),\n    workflowRunAttemptId: uuid('workflow_run_attempt_id').notNull(),\n    jobId: uuid('job_id').notNull(),\n    jobExecutionId: uuid('job_execution_id').notNull().unique(),\n    projectId: uuid('project_id').notNull(),\n    runnerSessionId: uuid('runner_session_id')\n      .notNull()\n      .references(() => runnerSessions.id),\n    provisionerId: uuid('provisioner_id'),\n    providerRunnerId: text('provider_runner_id'),\n    requiredLabels: text('required_labels').array().notNull(),\n    runnerLabels: text('runner_labels').array().notNull(),\n    startedAt: timestamp('started_at', {withTimezone: true}).notNull().defaultNow(),\n    firstHeartbeatAt: timestamp('first_heartbeat_at', {withTimezone: true}),\n    lastHeartbeatAt: timestamp('last_heartbeat_at', {withTimezone: true}).notNull().defaultNow(),\n    cancellationRequestedAt: timestamp('cancellation_requested_at', {withTimezone: true}),\n  },\n  (table) => [\n    index('runners_running_jobs_no_first_heartbeat_started_idx')\n      .on(table.startedAt)\n      .where(sql`\"first_heartbeat_at\" IS NULL`),\n    index('runners_running_jobs_last_heartbeat_at_idx').on(table.lastHeartbeatAt),\n    index('runners_running_jobs_provider_runner_started_idx')\n      .on(table.workspaceId, table.provisionerId, table.providerRunnerId, table.startedAt.desc())\n      .where(sql`\"provisioner_id\" IS NOT NULL`),\n    index('runners_running_jobs_cancellation_requested_idx')\n      .on(table.workspaceId, table.provisionerId, table.providerRunnerId)\n      .where(sql`\"cancellation_requested_at\" IS NOT NULL`),\n    index('runners_running_jobs_job_id_idx').on(table.jobId),\n    index('runners_running_jobs_runner_session_id_idx').on(table.runnerSessionId),\n    check(\n      'runners_running_jobs_link_ck',\n      sql`(${table.provisionerId} IS NULL) = (${table.providerRunnerId} IS NULL)`,\n    ),\n  ],\n);\n\nexport type RunningJobExecutionDb = typeof runningJobExecutions.$inferSelect;\nexport type RunningJobExecutionInsertDb = typeof runningJobExecutions.$inferInsert;\n"],"names":["uuidv7PrimaryKey","sql","check","index","text","timestamp","uuid","pgTable","runnerSessions","runningJobExecutions","id","workspaceId","notNull","workflowRunId","workflowRunAttemptId","jobId","jobExecutionId","unique","projectId","runnerSessionId","references","provisionerId","providerRunnerId","requiredLabels","array","runnerLabels","startedAt","withTimezone","defaultNow","firstHeartbeatAt","lastHeartbeatAt","cancellationRequestedAt","table","on","where","desc"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,GAAG,QAAO,cAAc;AAChC,SAAQC,KAAK,EAAEC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,IAAI,QAAO,sBAAsB;AACxE,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,cAAc,QAAO,uBAAuB;AAEpD,OAAO,MAAMC,uBAAuBF,QAClC,gBACA;IACEG,IAAIV;IACJW,aAAaL,KAAK,gBAAgBM,OAAO;IACzCC,eAAeP,KAAK,mBAAmBM,OAAO;IAC9CE,sBAAsBR,KAAK,2BAA2BM,OAAO;IAC7DG,OAAOT,KAAK,UAAUM,OAAO;IAC7BI,gBAAgBV,KAAK,oBAAoBM,OAAO,GAAGK,MAAM;IACzDC,WAAWZ,KAAK,cAAcM,OAAO;IACrCO,iBAAiBb,KAAK,qBACnBM,OAAO,GACPQ,UAAU,CAAC,IAAMZ,eAAeE,EAAE;IACrCW,eAAef,KAAK;IACpBgB,kBAAkBlB,KAAK;IACvBmB,gBAAgBnB,KAAK,mBAAmBoB,KAAK,GAAGZ,OAAO;IACvDa,cAAcrB,KAAK,iBAAiBoB,KAAK,GAAGZ,OAAO;IACnDc,WAAWrB,UAAU,cAAc;QAACsB,cAAc;IAAI,GAAGf,OAAO,GAAGgB,UAAU;IAC7EC,kBAAkBxB,UAAU,sBAAsB;QAACsB,cAAc;IAAI;IACrEG,iBAAiBzB,UAAU,qBAAqB;QAACsB,cAAc;IAAI,GAAGf,OAAO,GAAGgB,UAAU;IAC1FG,yBAAyB1B,UAAU,6BAA6B;QAACsB,cAAc;IAAI;AACrF,GACA,CAACK,QAAU;QACT7B,MAAM,uDACH8B,EAAE,CAACD,MAAMN,SAAS,EAClBQ,KAAK,CAACjC,GAAG,CAAC,4BAA4B,CAAC;QAC1CE,MAAM,8CAA8C8B,EAAE,CAACD,MAAMF,eAAe;QAC5E3B,MAAM,oDACH8B,EAAE,CAACD,MAAMrB,WAAW,EAAEqB,MAAMX,aAAa,EAAEW,MAAMV,gBAAgB,EAAEU,MAAMN,SAAS,CAACS,IAAI,IACvFD,KAAK,CAACjC,GAAG,CAAC,4BAA4B,CAAC;QAC1CE,MAAM,mDACH8B,EAAE,CAACD,MAAMrB,WAAW,EAAEqB,MAAMX,aAAa,EAAEW,MAAMV,gBAAgB,EACjEY,KAAK,CAACjC,GAAG,CAAC,uCAAuC,CAAC;QACrDE,MAAM,mCAAmC8B,EAAE,CAACD,MAAMjB,KAAK;QACvDZ,MAAM,8CAA8C8B,EAAE,CAACD,MAAMb,eAAe;QAC5EjB,MACE,gCACAD,GAAG,CAAC,CAAC,EAAE+B,MAAMX,aAAa,CAAC,aAAa,EAAEW,MAAMV,gBAAgB,CAAC,SAAS,CAAC;KAE9E,EACD"}

package/dist/index.d.ts

@@ -1,6 +1,10 @@
+import type { AuthInterModuleClient } from '@shipfox/api-auth-dto/inter-module';
 import { type ShipfoxModule } from '@shipfox/node-module';
-export { type MintEphemeralRegistrationTokenParams, type MintEphemeralRegistrationTokenResult, type MintEphemeralRegistrationTokensBatchParams, type MintEphemeralRegistrationTokensBatchProvisionedRunner, type MintEphemeralRegistrationTokensBatchResult, mintEphemeralRegistrationToken, mintEphemeralRegistrationTokensBatch, } from '#core/ephemeral-registration-tokens.js';
+import type { CreateRunnersModuleOptions } from '#installation-provisioning.js';
 export { type EffectiveRunnerToolCapabilitiesResult, getEffectiveRunnerToolCapabilities, unadvertisedRunnerTools, } from '#core/runner-tool-capabilities.js';
 export { cancelRunnerJobs, type EnqueueJobExecutionParams, enqueueJobExecution, isJobLeaseActive, releaseJobExecution, } from '#db/index.js';
-export declare const runnersModule: ShipfoxModule;
+export type { CreateRunnersModuleOptions, InstallationProvisioningPolicy, } from '#installation-provisioning.js';
+export declare function createRunnersModule({ auth, ...options }: CreateRunnersModuleOptions & {
+    auth: AuthInterModuleClient;
+}): ShipfoxModule;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAC,KAAK,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAY3E,OAAO,EACL,KAAK,oCAAoC,EACzC,KAAK,oCAAoC,EACzC,KAAK,0CAA0C,EAC/C,KAAK,qDAAqD,EAC1D,KAAK,0CAA0C,EAC/C,8BAA8B,EAC9B,oCAAoC,GACrC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,KAAK,qCAAqC,EAC1C,kCAAkC,EAClC,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,KAAK,yBAAyB,EAC9B,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAOtB,eAAO,MAAM,aAAa,EAAE,aAgB3B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,oCAAoC,CAAC;AAM9E,OAAO,EAAC,KAAK,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAE3E,OAAO,KAAK,EAAC,0BAA0B,EAAC,MAAM,+BAA+B,CAAC;AAa9E,OAAO,EACL,KAAK,qCAAqC,EAC1C,kCAAkC,EAClC,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,KAAK,yBAAyB,EAC9B,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AAOvC,wBAAgB,mBAAmB,CAAC,EAClC,IAAI,EACJ,GAAG,OAAO,EACX,EAAE,0BAA0B,GAAG;IAAC,IAAI,EAAE,qBAAqB,CAAA;CAAC,GAAG,aAAa,CAyB5E"}

package/dist/index.js

@@ -5,52 +5,58 @@ import { WORKFLOWS_JOB_EXECUTION_TIMED_OUT } from '@shipfox/api-workflows-dto';
 import { subscriberFactory } from '@shipfox/node-module';
 import { db, migrationsPath, runnersOutbox } from '#db/index.js';
 import { registerRunnersServiceMetrics } from '#metrics/index.js';
-import { createProvisionerTokenAuthMethod, createRunnerRegistrationTokenAuthMethod, onWorkflowsJobExecutionTimedOut, routes } from '#presentation/index.js';
+import { createProvisionerTokenAuthMethod, createRunnerControlSessionAuthMethod, createRunnerRegistrationTokenAuthMethod, createRunnerRoutes, onWorkflowsJobExecutionTimedOut } from '#presentation/index.js';
+import { createRunnersInterModulePresentation } from '#presentation/inter-module.js';
 import { createRunnersMaintenanceActivities } from '#temporal/activities/index.js';
 import { RUNNERS_MAINTENANCE_TASK_QUEUE } from '#temporal/constants.js';
-export { mintEphemeralRegistrationToken, mintEphemeralRegistrationTokensBatch } from '#core/ephemeral-registration-tokens.js';
 export { getEffectiveRunnerToolCapabilities, unadvertisedRunnerTools } from '#core/runner-tool-capabilities.js';
 export { cancelRunnerJobs, enqueueJobExecution, isJobLeaseActive, releaseJobExecution } from '#db/index.js';
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');
 const subscriber = subscriberFactory();
-export const runnersModule = {
-    name: 'runners',
-    database: {
-        db,
-        migrationsPath
-    },
-    auth: [
-        createRunnerRegistrationTokenAuthMethod(),
-        createProvisionerTokenAuthMethod()
-    ],
-    routes,
-    metrics: registerRunnersServiceMetrics,
-    publishers: [
-        {
-            name: 'runners',
-            table: runnersOutbox,
+export function createRunnersModule({ auth, ...options }) {
+    return {
+        name: 'runners',
+        database: {
             db,
-            eventSchemas: runnersEventSchemas
-        }
-    ],
-    subscribers: [
-        subscriber(WORKFLOWS_JOB_EXECUTION_TIMED_OUT, onWorkflowsJobExecutionTimedOut)
-    ],
-    workers: [
-        {
-            taskQueue: RUNNERS_MAINTENANCE_TASK_QUEUE,
-            workflowsPath,
-            activities: createRunnersMaintenanceActivities,
-            workflows: [
-                {
-                    name: 'stuckJobDetector',
-                    id: 'stuck-job-detector',
-                    cronSchedule: '* * * * *'
-                }
-            ]
-        }
-    ]
-};
+            migrationsPath
+        },
+        auth: [
+            createRunnerRegistrationTokenAuthMethod(),
+            createRunnerControlSessionAuthMethod(),
+            createProvisionerTokenAuthMethod()
+        ],
+        routes: createRunnerRoutes(auth, options),
+        metrics: registerRunnersServiceMetrics,
+        publishers: [
+            {
+                name: 'runners',
+                table: runnersOutbox,
+                db,
+                eventSchemas: runnersEventSchemas
+            }
+        ],
+        subscribers: [
+            subscriber(WORKFLOWS_JOB_EXECUTION_TIMED_OUT, onWorkflowsJobExecutionTimedOut)
+        ],
+        workers: [
+            {
+                taskQueue: RUNNERS_MAINTENANCE_TASK_QUEUE,
+                workflowsPath,
+                activities: createRunnersMaintenanceActivities,
+                workflows: [
+                    {
+                        name: 'stuckJobDetector',
+                        id: 'stuck-job-detector',
+                        cronSchedule: '* * * * *'
+                    }
+                ]
+            }
+        ],
+        interModulePresentations: [
+            createRunnersInterModulePresentation()
+        ]
+    };
+}
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {dirname, resolve} from 'node:path';\nimport {fileURLToPath} from 'node:url';\nimport {runnersEventSchemas} from '@shipfox/api-runners-dto';\nimport {\n  WORKFLOWS_JOB_EXECUTION_TIMED_OUT,\n  type WorkflowsEventMapDto,\n} from '@shipfox/api-workflows-dto';\nimport {type ShipfoxModule, subscriberFactory} from '@shipfox/node-module';\nimport {db, migrationsPath, runnersOutbox} from '#db/index.js';\nimport {registerRunnersServiceMetrics} from '#metrics/index.js';\nimport {\n  createProvisionerTokenAuthMethod,\n  createRunnerRegistrationTokenAuthMethod,\n  onWorkflowsJobExecutionTimedOut,\n  routes,\n} from '#presentation/index.js';\nimport {createRunnersMaintenanceActivities} from '#temporal/activities/index.js';\nimport {RUNNERS_MAINTENANCE_TASK_QUEUE} from '#temporal/constants.js';\n\nexport {\n  type MintEphemeralRegistrationTokenParams,\n  type MintEphemeralRegistrationTokenResult,\n  type MintEphemeralRegistrationTokensBatchParams,\n  type MintEphemeralRegistrationTokensBatchProvisionedRunner,\n  type MintEphemeralRegistrationTokensBatchResult,\n  mintEphemeralRegistrationToken,\n  mintEphemeralRegistrationTokensBatch,\n} from '#core/ephemeral-registration-tokens.js';\nexport {\n  type EffectiveRunnerToolCapabilitiesResult,\n  getEffectiveRunnerToolCapabilities,\n  unadvertisedRunnerTools,\n} from '#core/runner-tool-capabilities.js';\nexport {\n  cancelRunnerJobs,\n  type EnqueueJobExecutionParams,\n  enqueueJobExecution,\n  isJobLeaseActive,\n  releaseJobExecution,\n} from '#db/index.js';\n\nconst packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');\nconst workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');\n\nconst subscriber = subscriberFactory<WorkflowsEventMapDto>();\n\nexport const runnersModule: ShipfoxModule = {\n  name: 'runners',\n  database: {db, migrationsPath},\n  auth: [createRunnerRegistrationTokenAuthMethod(), createProvisionerTokenAuthMethod()],\n  routes,\n  metrics: registerRunnersServiceMetrics,\n  publishers: [{name: 'runners', table: runnersOutbox, db, eventSchemas: runnersEventSchemas}],\n  subscribers: [subscriber(WORKFLOWS_JOB_EXECUTION_TIMED_OUT, onWorkflowsJobExecutionTimedOut)],\n  workers: [\n    {\n      taskQueue: RUNNERS_MAINTENANCE_TASK_QUEUE,\n      workflowsPath,\n      activities: createRunnersMaintenanceActivities,\n      workflows: [{name: 'stuckJobDetector', id: 'stuck-job-detector', cronSchedule: '* * * * *'}],\n    },\n  ],\n};\n"],"names":["dirname","resolve","fileURLToPath","runnersEventSchemas","WORKFLOWS_JOB_EXECUTION_TIMED_OUT","subscriberFactory","db","migrationsPath","runnersOutbox","registerRunnersServiceMetrics","createProvisionerTokenAuthMethod","createRunnerRegistrationTokenAuthMethod","onWorkflowsJobExecutionTimedOut","routes","createRunnersMaintenanceActivities","RUNNERS_MAINTENANCE_TASK_QUEUE","mintEphemeralRegistrationToken","mintEphemeralRegistrationTokensBatch","getEffectiveRunnerToolCapabilities","unadvertisedRunnerTools","cancelRunnerJobs","enqueueJobExecution","isJobLeaseActive","releaseJobExecution","packageRoot","url","workflowsPath","subscriber","runnersModule","name","database","auth","metrics","publishers","table","eventSchemas","subscribers","workers","taskQueue","activities","workflows","id","cronSchedule"],"mappings":"AAAA,SAAQA,OAAO,EAAEC,OAAO,QAAO,YAAY;AAC3C,SAAQC,aAAa,QAAO,WAAW;AACvC,SAAQC,mBAAmB,QAAO,2BAA2B;AAC7D,SACEC,iCAAiC,QAE5B,6BAA6B;AACpC,SAA4BC,iBAAiB,QAAO,uBAAuB;AAC3E,SAAQC,EAAE,EAAEC,cAAc,EAAEC,aAAa,QAAO,eAAe;AAC/D,SAAQC,6BAA6B,QAAO,oBAAoB;AAChE,SACEC,gCAAgC,EAChCC,uCAAuC,EACvCC,+BAA+B,EAC/BC,MAAM,QACD,yBAAyB;AAChC,SAAQC,kCAAkC,QAAO,gCAAgC;AACjF,SAAQC,8BAA8B,QAAO,yBAAyB;AAEtE,SAMEC,8BAA8B,EAC9BC,oCAAoC,QAC/B,yCAAyC;AAChD,SAEEC,kCAAkC,EAClCC,uBAAuB,QAClB,oCAAoC;AAC3C,SACEC,gBAAgB,EAEhBC,mBAAmB,EACnBC,gBAAgB,EAChBC,mBAAmB,QACd,eAAe;AAEtB,MAAMC,cAAcvB,QAAQD,QAAQE,cAAc,YAAYuB,GAAG,IAAI;AACrE,MAAMC,gBAAgBzB,QAAQuB,aAAa;AAE3C,MAAMG,aAAatB;AAEnB,OAAO,MAAMuB,gBAA+B;IAC1CC,MAAM;IACNC,UAAU;QAACxB;QAAIC;IAAc;IAC7BwB,MAAM;QAACpB;QAA2CD;KAAmC;IACrFG;IACAmB,SAASvB;IACTwB,YAAY;QAAC;YAACJ,MAAM;YAAWK,OAAO1B;YAAeF;YAAI6B,cAAchC;QAAmB;KAAE;IAC5FiC,aAAa;QAACT,WAAWvB,mCAAmCQ;KAAiC;IAC7FyB,SAAS;QACP;YACEC,WAAWvB;YACXW;YACAa,YAAYzB;YACZ0B,WAAW;gBAAC;oBAACX,MAAM;oBAAoBY,IAAI;oBAAsBC,cAAc;gBAAW;aAAE;QAC9F;KACD;AACH,EAAE"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {dirname, resolve} from 'node:path';\nimport {fileURLToPath} from 'node:url';\nimport type {AuthInterModuleClient} from '@shipfox/api-auth-dto/inter-module';\nimport {runnersEventSchemas} from '@shipfox/api-runners-dto';\nimport {\n  WORKFLOWS_JOB_EXECUTION_TIMED_OUT,\n  type WorkflowsEventMapDto,\n} from '@shipfox/api-workflows-dto';\nimport {type ShipfoxModule, subscriberFactory} from '@shipfox/node-module';\nimport {db, migrationsPath, runnersOutbox} from '#db/index.js';\nimport type {CreateRunnersModuleOptions} from '#installation-provisioning.js';\nimport {registerRunnersServiceMetrics} from '#metrics/index.js';\nimport {\n  createProvisionerTokenAuthMethod,\n  createRunnerControlSessionAuthMethod,\n  createRunnerRegistrationTokenAuthMethod,\n  createRunnerRoutes,\n  onWorkflowsJobExecutionTimedOut,\n} from '#presentation/index.js';\nimport {createRunnersInterModulePresentation} from '#presentation/inter-module.js';\nimport {createRunnersMaintenanceActivities} from '#temporal/activities/index.js';\nimport {RUNNERS_MAINTENANCE_TASK_QUEUE} from '#temporal/constants.js';\n\nexport {\n  type EffectiveRunnerToolCapabilitiesResult,\n  getEffectiveRunnerToolCapabilities,\n  unadvertisedRunnerTools,\n} from '#core/runner-tool-capabilities.js';\nexport {\n  cancelRunnerJobs,\n  type EnqueueJobExecutionParams,\n  enqueueJobExecution,\n  isJobLeaseActive,\n  releaseJobExecution,\n} from '#db/index.js';\nexport type {\n  CreateRunnersModuleOptions,\n  InstallationProvisioningPolicy,\n} from '#installation-provisioning.js';\n\nconst packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');\nconst workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');\n\nconst subscriber = subscriberFactory<WorkflowsEventMapDto>();\n\nexport function createRunnersModule({\n  auth,\n  ...options\n}: CreateRunnersModuleOptions & {auth: AuthInterModuleClient}): ShipfoxModule {\n  return {\n    name: 'runners',\n    database: {db, migrationsPath},\n    auth: [\n      createRunnerRegistrationTokenAuthMethod(),\n      createRunnerControlSessionAuthMethod(),\n      createProvisionerTokenAuthMethod(),\n    ],\n    routes: createRunnerRoutes(auth, options),\n    metrics: registerRunnersServiceMetrics,\n    publishers: [{name: 'runners', table: runnersOutbox, db, eventSchemas: runnersEventSchemas}],\n    subscribers: [subscriber(WORKFLOWS_JOB_EXECUTION_TIMED_OUT, onWorkflowsJobExecutionTimedOut)],\n    workers: [\n      {\n        taskQueue: RUNNERS_MAINTENANCE_TASK_QUEUE,\n        workflowsPath,\n        activities: createRunnersMaintenanceActivities,\n        workflows: [\n          {name: 'stuckJobDetector', id: 'stuck-job-detector', cronSchedule: '* * * * *'},\n        ],\n      },\n    ],\n    interModulePresentations: [createRunnersInterModulePresentation()],\n  };\n}\n"],"names":["dirname","resolve","fileURLToPath","runnersEventSchemas","WORKFLOWS_JOB_EXECUTION_TIMED_OUT","subscriberFactory","db","migrationsPath","runnersOutbox","registerRunnersServiceMetrics","createProvisionerTokenAuthMethod","createRunnerControlSessionAuthMethod","createRunnerRegistrationTokenAuthMethod","createRunnerRoutes","onWorkflowsJobExecutionTimedOut","createRunnersInterModulePresentation","createRunnersMaintenanceActivities","RUNNERS_MAINTENANCE_TASK_QUEUE","getEffectiveRunnerToolCapabilities","unadvertisedRunnerTools","cancelRunnerJobs","enqueueJobExecution","isJobLeaseActive","releaseJobExecution","packageRoot","url","workflowsPath","subscriber","createRunnersModule","auth","options","name","database","routes","metrics","publishers","table","eventSchemas","subscribers","workers","taskQueue","activities","workflows","id","cronSchedule","interModulePresentations"],"mappings":"AAAA,SAAQA,OAAO,EAAEC,OAAO,QAAO,YAAY;AAC3C,SAAQC,aAAa,QAAO,WAAW;AAEvC,SAAQC,mBAAmB,QAAO,2BAA2B;AAC7D,SACEC,iCAAiC,QAE5B,6BAA6B;AACpC,SAA4BC,iBAAiB,QAAO,uBAAuB;AAC3E,SAAQC,EAAE,EAAEC,cAAc,EAAEC,aAAa,QAAO,eAAe;AAE/D,SAAQC,6BAA6B,QAAO,oBAAoB;AAChE,SACEC,gCAAgC,EAChCC,oCAAoC,EACpCC,uCAAuC,EACvCC,kBAAkB,EAClBC,+BAA+B,QAC1B,yBAAyB;AAChC,SAAQC,oCAAoC,QAAO,gCAAgC;AACnF,SAAQC,kCAAkC,QAAO,gCAAgC;AACjF,SAAQC,8BAA8B,QAAO,yBAAyB;AAEtE,SAEEC,kCAAkC,EAClCC,uBAAuB,QAClB,oCAAoC;AAC3C,SACEC,gBAAgB,EAEhBC,mBAAmB,EACnBC,gBAAgB,EAChBC,mBAAmB,QACd,eAAe;AAMtB,MAAMC,cAAcvB,QAAQD,QAAQE,cAAc,YAAYuB,GAAG,IAAI;AACrE,MAAMC,gBAAgBzB,QAAQuB,aAAa;AAE3C,MAAMG,aAAatB;AAEnB,OAAO,SAASuB,oBAAoB,EAClCC,IAAI,EACJ,GAAGC,SACwD;IAC3D,OAAO;QACLC,MAAM;QACNC,UAAU;YAAC1B;YAAIC;QAAc;QAC7BsB,MAAM;YACJjB;YACAD;YACAD;SACD;QACDuB,QAAQpB,mBAAmBgB,MAAMC;QACjCI,SAASzB;QACT0B,YAAY;YAAC;gBAACJ,MAAM;gBAAWK,OAAO5B;gBAAeF;gBAAI+B,cAAclC;YAAmB;SAAE;QAC5FmC,aAAa;YAACX,WAAWvB,mCAAmCU;SAAiC;QAC7FyB,SAAS;YACP;gBACEC,WAAWvB;gBACXS;gBACAe,YAAYzB;gBACZ0B,WAAW;oBACT;wBAACX,MAAM;wBAAoBY,IAAI;wBAAsBC,cAAc;oBAAW;iBAC/E;YACH;SACD;QACDC,0BAA0B;YAAC9B;SAAuC;IACpE;AACF"}

package/dist/installation-provisioning.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Lets an application host choose which workspaces may receive installation-provisioned capacity.
+ * The runners module passes candidate IDs in batches so host policy can apply its own entitlement
+ * or tenancy rules without exposing those rules from this package.
+ */
+export interface InstallationProvisioningPolicy {
+    filterEligibleWorkspaceIds(workspaceIds: readonly string[]): Promise<ReadonlySet<string>>;
+}
+export interface CreateRunnersModuleOptions {
+    installationProvisioning?: {
+        policy: InstallationProvisioningPolicy;
+    };
+}
+//# sourceMappingURL=installation-provisioning.d.ts.map

package/dist/installation-provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-provisioning.d.ts","sourceRoot":"","sources":["../src/installation-provisioning.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,0BAA0B,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CAC3F;AAED,MAAM,WAAW,0BAA0B;IACzC,wBAAwB,CAAC,EAAE;QACzB,MAAM,EAAE,8BAA8B,CAAC;KACxC,CAAC;CACH"}

package/dist/installation-provisioning.js

@@ -0,0 +1,7 @@
+/**
+ * Lets an application host choose which workspaces may receive installation-provisioned capacity.
+ * The runners module passes candidate IDs in batches so host policy can apply its own entitlement
+ * or tenancy rules without exposing those rules from this package.
+ */ export { };
+
+//# sourceMappingURL=installation-provisioning.js.map

package/dist/installation-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/installation-provisioning.ts"],"sourcesContent":["/**\n * Lets an application host choose which workspaces may receive installation-provisioned capacity.\n * The runners module passes candidate IDs in batches so host policy can apply its own entitlement\n * or tenancy rules without exposing those rules from this package.\n */\nexport interface InstallationProvisioningPolicy {\n  filterEligibleWorkspaceIds(workspaceIds: readonly string[]): Promise<ReadonlySet<string>>;\n}\n\nexport interface CreateRunnersModuleOptions {\n  installationProvisioning?: {\n    policy: InstallationProvisioningPolicy;\n  };\n}\n"],"names":[],"mappings":"AAAA;;;;CAIC,GAKD,WAIC"}

package/dist/metrics/index.d.ts

@@ -1,3 +1,3 @@
-export { jobExecutionClaimedCount, jobExecutionEnqueuedCount, jobExecutionLeaseExpiredCount, provisionedRunnerAbsentTerminatedCount, provisionedRunnerCountDivergenceCount, provisionedRunnerReconcileCallCount, provisionedRunnerTerminateIntentHonoredCount, provisionedRunnerTerminateIntentIssuedCount, recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure, } from './instance.js';
+export { jobExecutionClaimedCount, jobExecutionEnqueuedCount, jobExecutionLeaseExpiredCount, providerRunnerAbsentTerminatedCount, providerRunnerCountDivergenceCount, providerRunnerReconcileCallCount, providerRunnerTerminateIntentHonoredCount, providerRunnerTerminateIntentIssuedCount, recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure, } from './instance.js';
 export { registerRunnersServiceMetrics } from './service.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/metrics/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/metrics/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,sCAAsC,EACtC,qCAAqC,EACrC,mCAAmC,EACnC,4CAA4C,EAC5C,2CAA2C,EAC3C,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,6BAA6B,EAAC,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/metrics/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,kCAAkC,EAClC,gCAAgC,EAChC,yCAAyC,EACzC,wCAAwC,EACxC,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,6BAA6B,EAAC,MAAM,cAAc,CAAC"}

package/dist/metrics/index.js

@@ -1,4 +1,4 @@
-export { jobExecutionClaimedCount, jobExecutionEnqueuedCount, jobExecutionLeaseExpiredCount, provisionedRunnerAbsentTerminatedCount, provisionedRunnerCountDivergenceCount, provisionedRunnerReconcileCallCount, provisionedRunnerTerminateIntentHonoredCount, provisionedRunnerTerminateIntentIssuedCount, recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure } from './instance.js';
+export { jobExecutionClaimedCount, jobExecutionEnqueuedCount, jobExecutionLeaseExpiredCount, providerRunnerAbsentTerminatedCount, providerRunnerCountDivergenceCount, providerRunnerReconcileCallCount, providerRunnerTerminateIntentHonoredCount, providerRunnerTerminateIntentIssuedCount, recordRunnersRateLimitCheck, recordRunnersRateLimitPruneFailure } from './instance.js';
 export { registerRunnersServiceMetrics } from './service.js';
 
 //# sourceMappingURL=index.js.map

package/dist/metrics/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/metrics/index.ts"],"sourcesContent":["export {\n  jobExecutionClaimedCount,\n  jobExecutionEnqueuedCount,\n  jobExecutionLeaseExpiredCount,\n  provisionedRunnerAbsentTerminatedCount,\n  provisionedRunnerCountDivergenceCount,\n  provisionedRunnerReconcileCallCount,\n  provisionedRunnerTerminateIntentHonoredCount,\n  provisionedRunnerTerminateIntentIssuedCount,\n  recordRunnersRateLimitCheck,\n  recordRunnersRateLimitPruneFailure,\n} from './instance.js';\nexport {registerRunnersServiceMetrics} from './service.js';\n"],"names":["jobExecutionClaimedCount","jobExecutionEnqueuedCount","jobExecutionLeaseExpiredCount","provisionedRunnerAbsentTerminatedCount","provisionedRunnerCountDivergenceCount","provisionedRunnerReconcileCallCount","provisionedRunnerTerminateIntentHonoredCount","provisionedRunnerTerminateIntentIssuedCount","recordRunnersRateLimitCheck","recordRunnersRateLimitPruneFailure","registerRunnersServiceMetrics"],"mappings":"AAAA,SACEA,wBAAwB,EACxBC,yBAAyB,EACzBC,6BAA6B,EAC7BC,sCAAsC,EACtCC,qCAAqC,EACrCC,mCAAmC,EACnCC,4CAA4C,EAC5CC,2CAA2C,EAC3CC,2BAA2B,EAC3BC,kCAAkC,QAC7B,gBAAgB;AACvB,SAAQC,6BAA6B,QAAO,eAAe"}
+{"version":3,"sources":["../../src/metrics/index.ts"],"sourcesContent":["export {\n  jobExecutionClaimedCount,\n  jobExecutionEnqueuedCount,\n  jobExecutionLeaseExpiredCount,\n  providerRunnerAbsentTerminatedCount,\n  providerRunnerCountDivergenceCount,\n  providerRunnerReconcileCallCount,\n  providerRunnerTerminateIntentHonoredCount,\n  providerRunnerTerminateIntentIssuedCount,\n  recordRunnersRateLimitCheck,\n  recordRunnersRateLimitPruneFailure,\n} from './instance.js';\nexport {registerRunnersServiceMetrics} from './service.js';\n"],"names":["jobExecutionClaimedCount","jobExecutionEnqueuedCount","jobExecutionLeaseExpiredCount","providerRunnerAbsentTerminatedCount","providerRunnerCountDivergenceCount","providerRunnerReconcileCallCount","providerRunnerTerminateIntentHonoredCount","providerRunnerTerminateIntentIssuedCount","recordRunnersRateLimitCheck","recordRunnersRateLimitPruneFailure","registerRunnersServiceMetrics"],"mappings":"AAAA,SACEA,wBAAwB,EACxBC,yBAAyB,EACzBC,6BAA6B,EAC7BC,mCAAmC,EACnCC,kCAAkC,EAClCC,gCAAgC,EAChCC,yCAAyC,EACzCC,wCAAwC,EACxCC,2BAA2B,EAC3BC,kCAAkC,QAC7B,gBAAgB;AACvB,SAAQC,6BAA6B,QAAO,eAAe"}

package/dist/metrics/instance.d.ts

@@ -3,22 +3,26 @@ export declare const jobExecutionClaimedCount: import("@shipfox/node-opentelemet
     outcome: "claimed" | "empty";
 }>;
 export declare const jobExecutionLeaseExpiredCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
-export declare const provisionedRunnerReportCount: import("@shipfox/node-opentelemetry").Counter<{
+export declare const providerRunnerReportCount: import("@shipfox/node-opentelemetry").Counter<{
     state: "starting" | "running" | "stopping" | "stopped" | "failed" | "terminated";
 }>;
-export declare const provisionedRunnerReapedCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
-export declare const provisionedRunnerCountDivergenceCount: import("@shipfox/node-opentelemetry").Counter<{
+export declare const runnerBootstrapExchangeCount: import("@shipfox/node-opentelemetry").Counter<{
+    outcome: "accepted" | "rejected";
+}>;
+export declare const runnerControlHeartbeatCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
+export declare const providerRunnerReapedCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
+export declare const providerRunnerCountDivergenceCount: import("@shipfox/node-opentelemetry").Counter<{
     template_key?: string;
     state: "starting" | "running";
     direction: "backend-higher" | "advertised-higher";
 }>;
-export declare const provisionedRunnerReconcileCallCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
-export declare const provisionedRunnerAbsentTerminatedCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
-export declare const provisionedRunnerTerminateIntentIssuedCount: import("@shipfox/node-opentelemetry").Counter<{
+export declare const providerRunnerReconcileCallCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
+export declare const providerRunnerAbsentTerminatedCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;
+export declare const providerRunnerTerminateIntentIssuedCount: import("@shipfox/node-opentelemetry").Counter<{
     surface: "poll-demand" | "reconcile";
     reason: "job-cancelled" | "terminal-state";
 }>;
-export declare const provisionedRunnerTerminateIntentHonoredCount: import("@shipfox/node-opentelemetry").Counter<{
+export declare const providerRunnerTerminateIntentHonoredCount: import("@shipfox/node-opentelemetry").Counter<{
     reason: "job-cancelled";
 }>;
 export declare const reservationReleasedCount: import("@shipfox/node-opentelemetry").Counter<Record<string, never>>;

package/dist/metrics/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,sEAKrC,CAAC;AAEF,eAAO,MAAM,wBAAwB;aAAiC,SAAS,GAAG,OAAO;EAGxF,CAAC;AAEF,eAAO,MAAM,6BAA6B,sEAGzC,CAAC;AAEF,eAAO,MAAM,4BAA4B;WAChC,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY;EAGhF,CAAC;AAEH,eAAO,MAAM,4BAA4B,sEAKxC,CAAC;AAEF,eAAO,MAAM,qCAAqC;mBACjC,MAAM;WACd,UAAU,GAAG,SAAS;eAClB,gBAAgB,GAAG,mBAAmB;EAIjD,CAAC;AAEH,eAAO,MAAM,mCAAmC,sEAG/C,CAAC;AAEF,eAAO,MAAM,sCAAsC,sEAMlD,CAAC;AAEF,eAAO,MAAM,2CAA2C;aAC7C,aAAa,GAAG,WAAW;YAC5B,eAAe,GAAG,gBAAgB;EAG1C,CAAC;AAEH,eAAO,MAAM,4CAA4C;YAC/C,eAAe;EAGvB,CAAC;AAEH,eAAO,MAAM,wBAAwB,sEAGpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAC/E,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,iBAAiB,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAsB5E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,OAAO,EAAE,uBAAuB,CAAC;CAClC,GAAG,IAAI,CAQP;AAED,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,yBAAyB,sEAKrC,CAAC;AAEF,eAAO,MAAM,wBAAwB;aAAiC,SAAS,GAAG,OAAO;EAGxF,CAAC;AAEF,eAAO,MAAM,6BAA6B,sEAGzC,CAAC;AAEF,eAAO,MAAM,yBAAyB;WAC7B,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY;EAGhF,CAAC;AAEH,eAAO,MAAM,4BAA4B;aAC9B,UAAU,GAAG,UAAU;EAGhC,CAAC;AAEH,eAAO,MAAM,2BAA2B,sEAGvC,CAAC;AAEF,eAAO,MAAM,yBAAyB,sEAKrC,CAAC;AAEF,eAAO,MAAM,kCAAkC;mBAC9B,MAAM;WACd,UAAU,GAAG,SAAS;eAClB,gBAAgB,GAAG,mBAAmB;EAIjD,CAAC;AAEH,eAAO,MAAM,gCAAgC,sEAG5C,CAAC;AAEF,eAAO,MAAM,mCAAmC,sEAM/C,CAAC;AAEF,eAAO,MAAM,wCAAwC;aAC1C,aAAa,GAAG,WAAW;YAC5B,eAAe,GAAG,gBAAgB;EAG1C,CAAC;AAEH,eAAO,MAAM,yCAAyC;YAC5C,eAAe;EAGvB,CAAC;AAEH,eAAO,MAAM,wBAAwB,sEAGpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAC/E,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,iBAAiB,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAsB5E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,sBAAsB,CAAC;IAC/B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,OAAO,EAAE,uBAAuB,CAAC;CAClC,GAAG,IAAI,CAQP;AAED,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD"}

package/dist/metrics/instance.js

@@ -9,25 +9,31 @@ export const jobExecutionClaimedCount = meter.createCounter('runners_job_executi
 export const jobExecutionLeaseExpiredCount = meter.createCounter('runners_job_execution_lease_expired', {
     description: 'Job execution leases reaped after passing the heartbeat threshold'
 });
-export const provisionedRunnerReportCount = meter.createCounter('runners_provisioned_runner_reported', {
+export const providerRunnerReportCount = meter.createCounter('runners_provider_runner_reported', {
     description: 'Provisioned runner lifecycle reports accepted by state'
 });
-export const provisionedRunnerReapedCount = meter.createCounter('runners_provisioned_runner_reaped', {
+export const runnerBootstrapExchangeCount = meter.createCounter('runners_runner_bootstrap_exchange', {
+    description: 'Runner bootstrap-token exchanges by outcome'
+});
+export const runnerControlHeartbeatCount = meter.createCounter('runners_runner_control_heartbeat', {
+    description: 'Pre-workspace runner-control heartbeats accepted'
+});
+export const providerRunnerReapedCount = meter.createCounter('runners_provider_runner_reaped', {
     description: 'Stale provisioned runners marked failed by backend maintenance'
 });
-export const provisionedRunnerCountDivergenceCount = meter.createCounter('runners_provisioned_runner_count_divergence', {
+export const providerRunnerCountDivergenceCount = meter.createCounter('runners_provider_runner_count_divergence', {
     description: 'Absolute difference between provisioner-advertised and backend-observed provisioned runner counts'
 });
-export const provisionedRunnerReconcileCallCount = meter.createCounter('runners_provisioned_runner_reconcile_called', {
+export const providerRunnerReconcileCallCount = meter.createCounter('runners_provider_runner_reconcile_called', {
     description: 'Provisioned runner reconcile calls completed successfully'
 });
-export const provisionedRunnerAbsentTerminatedCount = meter.createCounter('runners_provisioned_runner_absent_terminated', {
+export const providerRunnerAbsentTerminatedCount = meter.createCounter('runners_provider_runner_absent_terminated', {
     description: 'Owned provisioned runners marked terminated because they were absent from reconcile'
 });
-export const provisionedRunnerTerminateIntentIssuedCount = meter.createCounter('runners_provisioned_runner_terminate_intent_issued', {
+export const providerRunnerTerminateIntentIssuedCount = meter.createCounter('runners_provider_runner_terminate_intent_issued', {
     description: 'Provisioned runner terminate intents returned to provisioners'
 });
-export const provisionedRunnerTerminateIntentHonoredCount = meter.createCounter('runners_provisioned_runner_terminate_intent_honored', {
+export const providerRunnerTerminateIntentHonoredCount = meter.createCounter('runners_provider_runner_terminate_intent_honored', {
     description: 'Provisioned runner terminate intents honored by first transition to terminated'
 });
 export const reservationReleasedCount = meter.createCounter('runners_reservation_released', {

package/dist/metrics/instance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nconst meter = instanceMetrics.getMeter('runners');\n\nexport const jobExecutionEnqueuedCount = meter.createCounter<Record<string, never>>(\n  'runners_job_execution_enqueued',\n  {\n    description: 'Job executions added to the pending queue',\n  },\n);\n\nexport const jobExecutionClaimedCount = meter.createCounter<{outcome: 'claimed' | 'empty'}>(\n  'runners_job_execution_claimed',\n  {description: 'Job execution claim attempts by outcome'},\n);\n\nexport const jobExecutionLeaseExpiredCount = meter.createCounter<Record<string, never>>(\n  'runners_job_execution_lease_expired',\n  {description: 'Job execution leases reaped after passing the heartbeat threshold'},\n);\n\nexport const provisionedRunnerReportCount = meter.createCounter<{\n  state: 'starting' | 'running' | 'stopping' | 'stopped' | 'failed' | 'terminated';\n}>('runners_provisioned_runner_reported', {\n  description: 'Provisioned runner lifecycle reports accepted by state',\n});\n\nexport const provisionedRunnerReapedCount = meter.createCounter<Record<string, never>>(\n  'runners_provisioned_runner_reaped',\n  {\n    description: 'Stale provisioned runners marked failed by backend maintenance',\n  },\n);\n\nexport const provisionedRunnerCountDivergenceCount = meter.createCounter<{\n  template_key?: string;\n  state: 'starting' | 'running';\n  direction: 'backend-higher' | 'advertised-higher';\n}>('runners_provisioned_runner_count_divergence', {\n  description:\n    'Absolute difference between provisioner-advertised and backend-observed provisioned runner counts',\n});\n\nexport const provisionedRunnerReconcileCallCount = meter.createCounter<Record<string, never>>(\n  'runners_provisioned_runner_reconcile_called',\n  {description: 'Provisioned runner reconcile calls completed successfully'},\n);\n\nexport const provisionedRunnerAbsentTerminatedCount = meter.createCounter<Record<string, never>>(\n  'runners_provisioned_runner_absent_terminated',\n  {\n    description:\n      'Owned provisioned runners marked terminated because they were absent from reconcile',\n  },\n);\n\nexport const provisionedRunnerTerminateIntentIssuedCount = meter.createCounter<{\n  surface: 'poll-demand' | 'reconcile';\n  reason: 'job-cancelled' | 'terminal-state';\n}>('runners_provisioned_runner_terminate_intent_issued', {\n  description: 'Provisioned runner terminate intents returned to provisioners',\n});\n\nexport const provisionedRunnerTerminateIntentHonoredCount = meter.createCounter<{\n  reason: 'job-cancelled';\n}>('runners_provisioned_runner_terminate_intent_honored', {\n  description: 'Provisioned runner terminate intents honored by first transition to terminated',\n});\n\nexport const reservationReleasedCount = meter.createCounter<Record<string, never>>(\n  'runners_reservation_released',\n  {description: 'Reservation units released from terminal provisioned runner reports'},\n);\n\nexport type RunnersRateLimitAction = 'provisioner-mint' | 'ephemeral-register';\nexport type RunnersRateLimitScope = 'provisioner' | 'ephemeral-token';\nexport type RunnersRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  outcome: RunnersRateLimitOutcome;\n}>('runners_rate_limit_checks', {\n  description: 'Runners rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('runners_rate_limit_prune_failures', {\n  description: 'Runners rate limit prune failures',\n});\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect runner or provisioner request outcomes.\n  }\n}\n\nexport function recordRunnersRateLimitCheck(params: {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  outcome: RunnersRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordRunnersRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n"],"names":["instanceMetrics","meter","getMeter","jobExecutionEnqueuedCount","createCounter","description","jobExecutionClaimedCount","jobExecutionLeaseExpiredCount","provisionedRunnerReportCount","provisionedRunnerReapedCount","provisionedRunnerCountDivergenceCount","provisionedRunnerReconcileCallCount","provisionedRunnerAbsentTerminatedCount","provisionedRunnerTerminateIntentIssuedCount","provisionedRunnerTerminateIntentHonoredCount","reservationReleasedCount","rateLimitCheckCount","rateLimitPruneFailureCount","recordMetric","record","recordRunnersRateLimitCheck","params","add","action","scope","outcome","recordRunnersRateLimitPruneFailure"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAE5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,OAAO,MAAMC,4BAA4BF,MAAMG,aAAa,CAC1D,kCACA;IACEC,aAAa;AACf,GACA;AAEF,OAAO,MAAMC,2BAA2BL,MAAMG,aAAa,CACzD,iCACA;IAACC,aAAa;AAAyC,GACvD;AAEF,OAAO,MAAME,gCAAgCN,MAAMG,aAAa,CAC9D,uCACA;IAACC,aAAa;AAAmE,GACjF;AAEF,OAAO,MAAMG,+BAA+BP,MAAMG,aAAa,CAE5D,uCAAuC;IACxCC,aAAa;AACf,GAAG;AAEH,OAAO,MAAMI,+BAA+BR,MAAMG,aAAa,CAC7D,qCACA;IACEC,aAAa;AACf,GACA;AAEF,OAAO,MAAMK,wCAAwCT,MAAMG,aAAa,CAIrE,+CAA+C;IAChDC,aACE;AACJ,GAAG;AAEH,OAAO,MAAMM,sCAAsCV,MAAMG,aAAa,CACpE,+CACA;IAACC,aAAa;AAA2D,GACzE;AAEF,OAAO,MAAMO,yCAAyCX,MAAMG,aAAa,CACvE,gDACA;IACEC,aACE;AACJ,GACA;AAEF,OAAO,MAAMQ,8CAA8CZ,MAAMG,aAAa,CAG3E,sDAAsD;IACvDC,aAAa;AACf,GAAG;AAEH,OAAO,MAAMS,+CAA+Cb,MAAMG,aAAa,CAE5E,uDAAuD;IACxDC,aAAa;AACf,GAAG;AAEH,OAAO,MAAMU,2BAA2Bd,MAAMG,aAAa,CACzD,gCACA;IAACC,aAAa;AAAqE,GACnF;AAMF,MAAMW,sBAAsBf,MAAMG,aAAa,CAI5C,6BAA6B;IAC9BC,aAAa;AACf;AAEA,MAAMY,6BAA6BhB,MAAMG,aAAa,CAAC,qCAAqC;IAC1FC,aAAa;AACf;AAEA,SAASa,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,kEAAkE;IACpE;AACF;AAEA,OAAO,SAASC,4BAA4BC,MAI3C;IACCH,aAAa,IACXF,oBAAoBM,GAAG,CAAC,GAAG;YACzBC,QAAQF,OAAOE,MAAM;YACrBC,OAAOH,OAAOG,KAAK;YACnBC,SAASJ,OAAOI,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASC;IACdR,aAAa,IAAMD,2BAA2BK,GAAG,CAAC;AACpD"}
+{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nconst meter = instanceMetrics.getMeter('runners');\n\nexport const jobExecutionEnqueuedCount = meter.createCounter<Record<string, never>>(\n  'runners_job_execution_enqueued',\n  {\n    description: 'Job executions added to the pending queue',\n  },\n);\n\nexport const jobExecutionClaimedCount = meter.createCounter<{outcome: 'claimed' | 'empty'}>(\n  'runners_job_execution_claimed',\n  {description: 'Job execution claim attempts by outcome'},\n);\n\nexport const jobExecutionLeaseExpiredCount = meter.createCounter<Record<string, never>>(\n  'runners_job_execution_lease_expired',\n  {description: 'Job execution leases reaped after passing the heartbeat threshold'},\n);\n\nexport const providerRunnerReportCount = meter.createCounter<{\n  state: 'starting' | 'running' | 'stopping' | 'stopped' | 'failed' | 'terminated';\n}>('runners_provider_runner_reported', {\n  description: 'Provisioned runner lifecycle reports accepted by state',\n});\n\nexport const runnerBootstrapExchangeCount = meter.createCounter<{\n  outcome: 'accepted' | 'rejected';\n}>('runners_runner_bootstrap_exchange', {\n  description: 'Runner bootstrap-token exchanges by outcome',\n});\n\nexport const runnerControlHeartbeatCount = meter.createCounter<Record<string, never>>(\n  'runners_runner_control_heartbeat',\n  {description: 'Pre-workspace runner-control heartbeats accepted'},\n);\n\nexport const providerRunnerReapedCount = meter.createCounter<Record<string, never>>(\n  'runners_provider_runner_reaped',\n  {\n    description: 'Stale provisioned runners marked failed by backend maintenance',\n  },\n);\n\nexport const providerRunnerCountDivergenceCount = meter.createCounter<{\n  template_key?: string;\n  state: 'starting' | 'running';\n  direction: 'backend-higher' | 'advertised-higher';\n}>('runners_provider_runner_count_divergence', {\n  description:\n    'Absolute difference between provisioner-advertised and backend-observed provisioned runner counts',\n});\n\nexport const providerRunnerReconcileCallCount = meter.createCounter<Record<string, never>>(\n  'runners_provider_runner_reconcile_called',\n  {description: 'Provisioned runner reconcile calls completed successfully'},\n);\n\nexport const providerRunnerAbsentTerminatedCount = meter.createCounter<Record<string, never>>(\n  'runners_provider_runner_absent_terminated',\n  {\n    description:\n      'Owned provisioned runners marked terminated because they were absent from reconcile',\n  },\n);\n\nexport const providerRunnerTerminateIntentIssuedCount = meter.createCounter<{\n  surface: 'poll-demand' | 'reconcile';\n  reason: 'job-cancelled' | 'terminal-state';\n}>('runners_provider_runner_terminate_intent_issued', {\n  description: 'Provisioned runner terminate intents returned to provisioners',\n});\n\nexport const providerRunnerTerminateIntentHonoredCount = meter.createCounter<{\n  reason: 'job-cancelled';\n}>('runners_provider_runner_terminate_intent_honored', {\n  description: 'Provisioned runner terminate intents honored by first transition to terminated',\n});\n\nexport const reservationReleasedCount = meter.createCounter<Record<string, never>>(\n  'runners_reservation_released',\n  {description: 'Reservation units released from terminal provisioned runner reports'},\n);\n\nexport type RunnersRateLimitAction = 'provisioner-mint' | 'ephemeral-register';\nexport type RunnersRateLimitScope = 'provisioner' | 'ephemeral-token';\nexport type RunnersRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  outcome: RunnersRateLimitOutcome;\n}>('runners_rate_limit_checks', {\n  description: 'Runners rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('runners_rate_limit_prune_failures', {\n  description: 'Runners rate limit prune failures',\n});\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect runner or provisioner request outcomes.\n  }\n}\n\nexport function recordRunnersRateLimitCheck(params: {\n  action: RunnersRateLimitAction;\n  scope: RunnersRateLimitScope;\n  outcome: RunnersRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordRunnersRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n"],"names":["instanceMetrics","meter","getMeter","jobExecutionEnqueuedCount","createCounter","description","jobExecutionClaimedCount","jobExecutionLeaseExpiredCount","providerRunnerReportCount","runnerBootstrapExchangeCount","runnerControlHeartbeatCount","providerRunnerReapedCount","providerRunnerCountDivergenceCount","providerRunnerReconcileCallCount","providerRunnerAbsentTerminatedCount","providerRunnerTerminateIntentIssuedCount","providerRunnerTerminateIntentHonoredCount","reservationReleasedCount","rateLimitCheckCount","rateLimitPruneFailureCount","recordMetric","record","recordRunnersRateLimitCheck","params","add","action","scope","outcome","recordRunnersRateLimitPruneFailure"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAE5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,OAAO,MAAMC,4BAA4BF,MAAMG,aAAa,CAC1D,kCACA;IACEC,aAAa;AACf,GACA;AAEF,OAAO,MAAMC,2BAA2BL,MAAMG,aAAa,CACzD,iCACA;IAACC,aAAa;AAAyC,GACvD;AAEF,OAAO,MAAME,gCAAgCN,MAAMG,aAAa,CAC9D,uCACA;IAACC,aAAa;AAAmE,GACjF;AAEF,OAAO,MAAMG,4BAA4BP,MAAMG,aAAa,CAEzD,oCAAoC;IACrCC,aAAa;AACf,GAAG;AAEH,OAAO,MAAMI,+BAA+BR,MAAMG,aAAa,CAE5D,qCAAqC;IACtCC,aAAa;AACf,GAAG;AAEH,OAAO,MAAMK,8BAA8BT,MAAMG,aAAa,CAC5D,oCACA;IAACC,aAAa;AAAkD,GAChE;AAEF,OAAO,MAAMM,4BAA4BV,MAAMG,aAAa,CAC1D,kCACA;IACEC,aAAa;AACf,GACA;AAEF,OAAO,MAAMO,qCAAqCX,MAAMG,aAAa,CAIlE,4CAA4C;IAC7CC,aACE;AACJ,GAAG;AAEH,OAAO,MAAMQ,mCAAmCZ,MAAMG,aAAa,CACjE,4CACA;IAACC,aAAa;AAA2D,GACzE;AAEF,OAAO,MAAMS,sCAAsCb,MAAMG,aAAa,CACpE,6CACA;IACEC,aACE;AACJ,GACA;AAEF,OAAO,MAAMU,2CAA2Cd,MAAMG,aAAa,CAGxE,mDAAmD;IACpDC,aAAa;AACf,GAAG;AAEH,OAAO,MAAMW,4CAA4Cf,MAAMG,aAAa,CAEzE,oDAAoD;IACrDC,aAAa;AACf,GAAG;AAEH,OAAO,MAAMY,2BAA2BhB,MAAMG,aAAa,CACzD,gCACA;IAACC,aAAa;AAAqE,GACnF;AAMF,MAAMa,sBAAsBjB,MAAMG,aAAa,CAI5C,6BAA6B;IAC9BC,aAAa;AACf;AAEA,MAAMc,6BAA6BlB,MAAMG,aAAa,CAAC,qCAAqC;IAC1FC,aAAa;AACf;AAEA,SAASe,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,kEAAkE;IACpE;AACF;AAEA,OAAO,SAASC,4BAA4BC,MAI3C;IACCH,aAAa,IACXF,oBAAoBM,GAAG,CAAC,GAAG;YACzBC,QAAQF,OAAOE,MAAM;YACrBC,OAAOH,OAAOG,KAAK;YACnBC,SAASJ,OAAOI,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASC;IACdR,aAAa,IAAMD,2BAA2BK,GAAG,CAAC;AACpD"}

package/dist/presentation/auth/index.d.ts

@@ -1,3 +1,4 @@
 export { createProvisionerTokenAuthMethod } from './provisioner-token-auth.js';
+export { authenticateRunnerControlSession, createRunnerControlSessionAuthMethod, } from './runner-control-session-auth.js';
 export { createRunnerRegistrationTokenAuthMethod, getRunnerContext, type RunnerRegistrationContext, } from './runner-registration-token-auth.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/presentation/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gCAAgC,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EACL,uCAAuC,EACvC,gBAAgB,EAChB,KAAK,yBAAyB,GAC/B,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,gCAAgC,EAAC,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EACL,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,uCAAuC,EACvC,gBAAgB,EAChB,KAAK,yBAAyB,GAC/B,MAAM,qCAAqC,CAAC"}

package/dist/presentation/auth/index.js

@@ -1,4 +1,5 @@
 export { createProvisionerTokenAuthMethod } from './provisioner-token-auth.js';
+export { authenticateRunnerControlSession, createRunnerControlSessionAuthMethod } from './runner-control-session-auth.js';
 export { createRunnerRegistrationTokenAuthMethod, getRunnerContext } from './runner-registration-token-auth.js';
 
 //# sourceMappingURL=index.js.map

package/dist/presentation/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/auth/index.ts"],"sourcesContent":["export {createProvisionerTokenAuthMethod} from './provisioner-token-auth.js';\nexport {\n  createRunnerRegistrationTokenAuthMethod,\n  getRunnerContext,\n  type RunnerRegistrationContext,\n} from './runner-registration-token-auth.js';\n"],"names":["createProvisionerTokenAuthMethod","createRunnerRegistrationTokenAuthMethod","getRunnerContext"],"mappings":"AAAA,SAAQA,gCAAgC,QAAO,8BAA8B;AAC7E,SACEC,uCAAuC,EACvCC,gBAAgB,QAEX,sCAAsC"}
+{"version":3,"sources":["../../../src/presentation/auth/index.ts"],"sourcesContent":["export {createProvisionerTokenAuthMethod} from './provisioner-token-auth.js';\nexport {\n  authenticateRunnerControlSession,\n  createRunnerControlSessionAuthMethod,\n} from './runner-control-session-auth.js';\nexport {\n  createRunnerRegistrationTokenAuthMethod,\n  getRunnerContext,\n  type RunnerRegistrationContext,\n} from './runner-registration-token-auth.js';\n"],"names":["createProvisionerTokenAuthMethod","authenticateRunnerControlSession","createRunnerControlSessionAuthMethod","createRunnerRegistrationTokenAuthMethod","getRunnerContext"],"mappings":"AAAA,SAAQA,gCAAgC,QAAO,8BAA8B;AAC7E,SACEC,gCAAgC,EAChCC,oCAAoC,QAC/B,mCAAmC;AAC1C,SACEC,uCAAuC,EACvCC,gBAAgB,QAEX,sCAAsC"}

package/dist/presentation/auth/provisioner-token-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioner-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/provisioner-token-auth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AAQvF,wBAAgB,gCAAgC,IAAI,UAAU,CAoD7D"}
+{"version":3,"file":"provisioner-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/provisioner-token-auth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AAQvF,wBAAgB,gCAAgC,IAAI,UAAU,CAwD7D"}

package/dist/presentation/auth/provisioner-token-auth.js

@@ -54,8 +54,12 @@ export function createProvisionerTokenAuthMethod() {
                     status: 401
                 });
             }
-            const context = {
+            const context = provisionerToken.scope === 'installation' ? {
                 provisionerTokenId: provisionerToken.id,
+                scope: 'installation'
+            } : {
+                provisionerTokenId: provisionerToken.id,
+                scope: 'workspace',
                 workspaceId: provisionerToken.workspaceId
             };
             await touchProvisionerLastSeen({

package/dist/presentation/auth/provisioner-token-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/auth/provisioner-token-auth.ts"],"sourcesContent":["import {\n  AUTH_PROVISIONER_TOKEN,\n  type ProvisionerContext,\n  setProvisionerContext,\n} from '@shipfox/api-auth-context';\nimport {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {extractDisplayPrefix, getTokenType, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {resolveProvisionerTokenByHash, touchProvisionerLastSeen} from '#db/provisioner-tokens.js';\n\ntype AuthFailureReason = 'missing' | 'type' | 'not-found' | 'revoked' | 'expired';\n\nexport function createProvisionerTokenAuthMethod(): AuthMethod {\n  return {\n    name: AUTH_PROVISIONER_TOKEN,\n    authenticate: async (request) => {\n      const rawToken = extractBearerToken(request.headers.authorization);\n      if (!rawToken) {\n        logAuthFailure({reason: 'missing'});\n        throw new ClientError('Missing or invalid Authorization header', 'unauthorized', {\n          status: 401,\n        });\n      }\n\n      if (getTokenType(rawToken) !== 'provisionerToken') {\n        logAuthFailure({rawToken, reason: 'type'});\n        throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});\n      }\n\n      const provisionerToken = await resolveProvisionerTokenByHash(hashOpaqueToken(rawToken));\n      if (!provisionerToken) {\n        logAuthFailure({rawToken, reason: 'not-found'});\n        throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});\n      }\n\n      if (provisionerToken.revokedAt) {\n        logAuthFailure({rawToken, reason: 'revoked'});\n        throw new ClientError('Provisioner token has been revoked', 'provisioner-token-revoked', {\n          status: 401,\n        });\n      }\n\n      if (provisionerToken.expiresAt && provisionerToken.expiresAt <= new Date()) {\n        logAuthFailure({rawToken, reason: 'expired'});\n        throw new ClientError('Provisioner token has expired', 'provisioner-token-expired', {\n          status: 401,\n        });\n      }\n\n      const context: ProvisionerContext = {\n        provisionerTokenId: provisionerToken.id,\n        workspaceId: provisionerToken.workspaceId,\n      };\n\n      await touchProvisionerLastSeen({\n        tokenId: provisionerToken.id,\n        throttleSeconds: config.PROVISIONER_LAST_SEEN_THROTTLE_SECONDS,\n      }).catch((error: unknown) => {\n        logger().warn({error, provisionerTokenId: provisionerToken.id}, 'last-seen touch failed');\n      });\n\n      setProvisionerContext(request, context);\n    },\n  };\n}\n\nfunction logAuthFailure(params: {rawToken?: string | undefined; reason: AuthFailureReason}): void {\n  logger().warn(\n    {\n      prefix: params.rawToken ? extractDisplayPrefix(params.rawToken) : undefined,\n      reason: params.reason,\n    },\n    'provisioner token auth failed',\n  );\n}\n"],"names":["AUTH_PROVISIONER_TOKEN","setProvisionerContext","ClientError","extractBearerToken","logger","extractDisplayPrefix","getTokenType","hashOpaqueToken","config","resolveProvisionerTokenByHash","touchProvisionerLastSeen","createProvisionerTokenAuthMethod","name","authenticate","request","rawToken","headers","authorization","logAuthFailure","reason","status","provisionerToken","revokedAt","expiresAt","Date","context","provisionerTokenId","id","workspaceId","tokenId","throttleSeconds","PROVISIONER_LAST_SEEN_THROTTLE_SECONDS","catch","error","warn","params","prefix","undefined"],"mappings":"AAAA,SACEA,sBAAsB,EAEtBC,qBAAqB,QAChB,4BAA4B;AACnC,SAAyBC,WAAW,EAAEC,kBAAkB,QAAO,wBAAwB;AACvF,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,oBAAoB,EAAEC,YAAY,EAAEC,eAAe,QAAO,uBAAuB;AACzF,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,6BAA6B,EAAEC,wBAAwB,QAAO,4BAA4B;AAIlG,OAAO,SAASC;IACd,OAAO;QACLC,MAAMZ;QACNa,cAAc,OAAOC;YACnB,MAAMC,WAAWZ,mBAAmBW,QAAQE,OAAO,CAACC,aAAa;YACjE,IAAI,CAACF,UAAU;gBACbG,eAAe;oBAACC,QAAQ;gBAAS;gBACjC,MAAM,IAAIjB,YAAY,2CAA2C,gBAAgB;oBAC/EkB,QAAQ;gBACV;YACF;YAEA,IAAId,aAAaS,cAAc,oBAAoB;gBACjDG,eAAe;oBAACH;oBAAUI,QAAQ;gBAAM;gBACxC,MAAM,IAAIjB,YAAY,6BAA6B,gBAAgB;oBAACkB,QAAQ;gBAAG;YACjF;YAEA,MAAMC,mBAAmB,MAAMZ,8BAA8BF,gBAAgBQ;YAC7E,IAAI,CAACM,kBAAkB;gBACrBH,eAAe;oBAACH;oBAAUI,QAAQ;gBAAW;gBAC7C,MAAM,IAAIjB,YAAY,6BAA6B,gBAAgB;oBAACkB,QAAQ;gBAAG;YACjF;YAEA,IAAIC,iBAAiBC,SAAS,EAAE;gBAC9BJ,eAAe;oBAACH;oBAAUI,QAAQ;gBAAS;gBAC3C,MAAM,IAAIjB,YAAY,sCAAsC,6BAA6B;oBACvFkB,QAAQ;gBACV;YACF;YAEA,IAAIC,iBAAiBE,SAAS,IAAIF,iBAAiBE,SAAS,IAAI,IAAIC,QAAQ;gBAC1EN,eAAe;oBAACH;oBAAUI,QAAQ;gBAAS;gBAC3C,MAAM,IAAIjB,YAAY,iCAAiC,6BAA6B;oBAClFkB,QAAQ;gBACV;YACF;YAEA,MAAMK,UAA8B;gBAClCC,oBAAoBL,iBAAiBM,EAAE;gBACvCC,aAAaP,iBAAiBO,WAAW;YAC3C;YAEA,MAAMlB,yBAAyB;gBAC7BmB,SAASR,iBAAiBM,EAAE;gBAC5BG,iBAAiBtB,OAAOuB,sCAAsC;YAChE,GAAGC,KAAK,CAAC,CAACC;gBACR7B,SAAS8B,IAAI,CAAC;oBAACD;oBAAOP,oBAAoBL,iBAAiBM,EAAE;gBAAA,GAAG;YAClE;YAEA1B,sBAAsBa,SAASW;QACjC;IACF;AACF;AAEA,SAASP,eAAeiB,MAAkE;IACxF/B,SAAS8B,IAAI,CACX;QACEE,QAAQD,OAAOpB,QAAQ,GAAGV,qBAAqB8B,OAAOpB,QAAQ,IAAIsB;QAClElB,QAAQgB,OAAOhB,MAAM;IACvB,GACA;AAEJ"}
+{"version":3,"sources":["../../../src/presentation/auth/provisioner-token-auth.ts"],"sourcesContent":["import {\n  AUTH_PROVISIONER_TOKEN,\n  type ProvisionerContext,\n  setProvisionerContext,\n} from '@shipfox/api-auth-context';\nimport {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {extractDisplayPrefix, getTokenType, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {resolveProvisionerTokenByHash, touchProvisionerLastSeen} from '#db/provisioner-tokens.js';\n\ntype AuthFailureReason = 'missing' | 'type' | 'not-found' | 'revoked' | 'expired';\n\nexport function createProvisionerTokenAuthMethod(): AuthMethod {\n  return {\n    name: AUTH_PROVISIONER_TOKEN,\n    authenticate: async (request) => {\n      const rawToken = extractBearerToken(request.headers.authorization);\n      if (!rawToken) {\n        logAuthFailure({reason: 'missing'});\n        throw new ClientError('Missing or invalid Authorization header', 'unauthorized', {\n          status: 401,\n        });\n      }\n\n      if (getTokenType(rawToken) !== 'provisionerToken') {\n        logAuthFailure({rawToken, reason: 'type'});\n        throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});\n      }\n\n      const provisionerToken = await resolveProvisionerTokenByHash(hashOpaqueToken(rawToken));\n      if (!provisionerToken) {\n        logAuthFailure({rawToken, reason: 'not-found'});\n        throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});\n      }\n\n      if (provisionerToken.revokedAt) {\n        logAuthFailure({rawToken, reason: 'revoked'});\n        throw new ClientError('Provisioner token has been revoked', 'provisioner-token-revoked', {\n          status: 401,\n        });\n      }\n\n      if (provisionerToken.expiresAt && provisionerToken.expiresAt <= new Date()) {\n        logAuthFailure({rawToken, reason: 'expired'});\n        throw new ClientError('Provisioner token has expired', 'provisioner-token-expired', {\n          status: 401,\n        });\n      }\n\n      const context: ProvisionerContext =\n        provisionerToken.scope === 'installation'\n          ? {provisionerTokenId: provisionerToken.id, scope: 'installation'}\n          : {\n              provisionerTokenId: provisionerToken.id,\n              scope: 'workspace',\n              workspaceId: provisionerToken.workspaceId,\n            };\n\n      await touchProvisionerLastSeen({\n        tokenId: provisionerToken.id,\n        throttleSeconds: config.PROVISIONER_LAST_SEEN_THROTTLE_SECONDS,\n      }).catch((error: unknown) => {\n        logger().warn({error, provisionerTokenId: provisionerToken.id}, 'last-seen touch failed');\n      });\n\n      setProvisionerContext(request, context);\n    },\n  };\n}\n\nfunction logAuthFailure(params: {rawToken?: string | undefined; reason: AuthFailureReason}): void {\n  logger().warn(\n    {\n      prefix: params.rawToken ? extractDisplayPrefix(params.rawToken) : undefined,\n      reason: params.reason,\n    },\n    'provisioner token auth failed',\n  );\n}\n"],"names":["AUTH_PROVISIONER_TOKEN","setProvisionerContext","ClientError","extractBearerToken","logger","extractDisplayPrefix","getTokenType","hashOpaqueToken","config","resolveProvisionerTokenByHash","touchProvisionerLastSeen","createProvisionerTokenAuthMethod","name","authenticate","request","rawToken","headers","authorization","logAuthFailure","reason","status","provisionerToken","revokedAt","expiresAt","Date","context","scope","provisionerTokenId","id","workspaceId","tokenId","throttleSeconds","PROVISIONER_LAST_SEEN_THROTTLE_SECONDS","catch","error","warn","params","prefix","undefined"],"mappings":"AAAA,SACEA,sBAAsB,EAEtBC,qBAAqB,QAChB,4BAA4B;AACnC,SAAyBC,WAAW,EAAEC,kBAAkB,QAAO,wBAAwB;AACvF,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,oBAAoB,EAAEC,YAAY,EAAEC,eAAe,QAAO,uBAAuB;AACzF,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,6BAA6B,EAAEC,wBAAwB,QAAO,4BAA4B;AAIlG,OAAO,SAASC;IACd,OAAO;QACLC,MAAMZ;QACNa,cAAc,OAAOC;YACnB,MAAMC,WAAWZ,mBAAmBW,QAAQE,OAAO,CAACC,aAAa;YACjE,IAAI,CAACF,UAAU;gBACbG,eAAe;oBAACC,QAAQ;gBAAS;gBACjC,MAAM,IAAIjB,YAAY,2CAA2C,gBAAgB;oBAC/EkB,QAAQ;gBACV;YACF;YAEA,IAAId,aAAaS,cAAc,oBAAoB;gBACjDG,eAAe;oBAACH;oBAAUI,QAAQ;gBAAM;gBACxC,MAAM,IAAIjB,YAAY,6BAA6B,gBAAgB;oBAACkB,QAAQ;gBAAG;YACjF;YAEA,MAAMC,mBAAmB,MAAMZ,8BAA8BF,gBAAgBQ;YAC7E,IAAI,CAACM,kBAAkB;gBACrBH,eAAe;oBAACH;oBAAUI,QAAQ;gBAAW;gBAC7C,MAAM,IAAIjB,YAAY,6BAA6B,gBAAgB;oBAACkB,QAAQ;gBAAG;YACjF;YAEA,IAAIC,iBAAiBC,SAAS,EAAE;gBAC9BJ,eAAe;oBAACH;oBAAUI,QAAQ;gBAAS;gBAC3C,MAAM,IAAIjB,YAAY,sCAAsC,6BAA6B;oBACvFkB,QAAQ;gBACV;YACF;YAEA,IAAIC,iBAAiBE,SAAS,IAAIF,iBAAiBE,SAAS,IAAI,IAAIC,QAAQ;gBAC1EN,eAAe;oBAACH;oBAAUI,QAAQ;gBAAS;gBAC3C,MAAM,IAAIjB,YAAY,iCAAiC,6BAA6B;oBAClFkB,QAAQ;gBACV;YACF;YAEA,MAAMK,UACJJ,iBAAiBK,KAAK,KAAK,iBACvB;gBAACC,oBAAoBN,iBAAiBO,EAAE;gBAAEF,OAAO;YAAc,IAC/D;gBACEC,oBAAoBN,iBAAiBO,EAAE;gBACvCF,OAAO;gBACPG,aAAaR,iBAAiBQ,WAAW;YAC3C;YAEN,MAAMnB,yBAAyB;gBAC7BoB,SAAST,iBAAiBO,EAAE;gBAC5BG,iBAAiBvB,OAAOwB,sCAAsC;YAChE,GAAGC,KAAK,CAAC,CAACC;gBACR9B,SAAS+B,IAAI,CAAC;oBAACD;oBAAOP,oBAAoBN,iBAAiBO,EAAE;gBAAA,GAAG;YAClE;YAEA3B,sBAAsBa,SAASW;QACjC;IACF;AACF;AAEA,SAASP,eAAekB,MAAkE;IACxFhC,SAAS+B,IAAI,CACX;QACEE,QAAQD,OAAOrB,QAAQ,GAAGV,qBAAqB+B,OAAOrB,QAAQ,IAAIuB;QAClEnB,QAAQiB,OAAOjB,MAAM;IACvB,GACA;AAEJ"}

package/dist/presentation/auth/runner-control-session-auth.d.ts

@@ -0,0 +1,4 @@
+import { type AuthMethod } from '@shipfox/node-fastify';
+export declare function createRunnerControlSessionAuthMethod(): AuthMethod;
+export declare function authenticateRunnerControlSession(request: Parameters<AuthMethod['authenticate']>[0]): Promise<void>;
+//# sourceMappingURL=runner-control-session-auth.d.ts.map

package/dist/presentation/auth/runner-control-session-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-control-session-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/runner-control-session-auth.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AAIvF,wBAAgB,oCAAoC,IAAI,UAAU,CAKjE;AAED,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,iBAcnD"}

package/dist/presentation/auth/runner-control-session-auth.js

@@ -0,0 +1,29 @@
+import { AUTH_RUNNER_CONTROL_SESSION, setRunnerControlSessionContext } from '@shipfox/api-auth-context';
+import { ClientError, extractBearerToken } from '@shipfox/node-fastify';
+import { getTokenType } from '@shipfox/node-tokens';
+import { resolveRunnerControlSession } from '#core/runner-control-sessions.js';
+export function createRunnerControlSessionAuthMethod() {
+    return {
+        name: AUTH_RUNNER_CONTROL_SESSION,
+        authenticate: authenticateRunnerControlSession
+    };
+}
+export async function authenticateRunnerControlSession(request) {
+    const rawToken = extractBearerToken(request.headers.authorization);
+    if (!rawToken || getTokenType(rawToken) !== 'runnerControlSession') {
+        throw new ClientError('Invalid runner control session', 'unauthorized', {
+            status: 401
+        });
+    }
+    const session = await resolveRunnerControlSession(rawToken);
+    if (!session) throw new ClientError('Invalid runner control session', 'unauthorized', {
+        status: 401
+    });
+    setRunnerControlSessionContext(request, {
+        runnerControlSessionId: session.id,
+        runnerInstanceId: session.runnerInstanceId,
+        provisionerId: session.provisionerId
+    });
+}
+
+//# sourceMappingURL=runner-control-session-auth.js.map

package/dist/presentation/auth/runner-control-session-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/auth/runner-control-session-auth.ts"],"sourcesContent":["import {\n  AUTH_RUNNER_CONTROL_SESSION,\n  setRunnerControlSessionContext,\n} from '@shipfox/api-auth-context';\nimport {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';\nimport {getTokenType} from '@shipfox/node-tokens';\nimport {resolveRunnerControlSession} from '#core/runner-control-sessions.js';\n\nexport function createRunnerControlSessionAuthMethod(): AuthMethod {\n  return {\n    name: AUTH_RUNNER_CONTROL_SESSION,\n    authenticate: authenticateRunnerControlSession,\n  };\n}\n\nexport async function authenticateRunnerControlSession(\n  request: Parameters<AuthMethod['authenticate']>[0],\n) {\n  const rawToken = extractBearerToken(request.headers.authorization);\n  if (!rawToken || getTokenType(rawToken) !== 'runnerControlSession') {\n    throw new ClientError('Invalid runner control session', 'unauthorized', {status: 401});\n  }\n  const session = await resolveRunnerControlSession(rawToken);\n  if (!session)\n    throw new ClientError('Invalid runner control session', 'unauthorized', {status: 401});\n  setRunnerControlSessionContext(request, {\n    runnerControlSessionId: session.id,\n    runnerInstanceId: session.runnerInstanceId,\n    provisionerId: session.provisionerId,\n  });\n}\n"],"names":["AUTH_RUNNER_CONTROL_SESSION","setRunnerControlSessionContext","ClientError","extractBearerToken","getTokenType","resolveRunnerControlSession","createRunnerControlSessionAuthMethod","name","authenticate","authenticateRunnerControlSession","request","rawToken","headers","authorization","status","session","runnerControlSessionId","id","runnerInstanceId","provisionerId"],"mappings":"AAAA,SACEA,2BAA2B,EAC3BC,8BAA8B,QACzB,4BAA4B;AACnC,SAAyBC,WAAW,EAAEC,kBAAkB,QAAO,wBAAwB;AACvF,SAAQC,YAAY,QAAO,uBAAuB;AAClD,SAAQC,2BAA2B,QAAO,mCAAmC;AAE7E,OAAO,SAASC;IACd,OAAO;QACLC,MAAMP;QACNQ,cAAcC;IAChB;AACF;AAEA,OAAO,eAAeA,iCACpBC,OAAkD;IAElD,MAAMC,WAAWR,mBAAmBO,QAAQE,OAAO,CAACC,aAAa;IACjE,IAAI,CAACF,YAAYP,aAAaO,cAAc,wBAAwB;QAClE,MAAM,IAAIT,YAAY,kCAAkC,gBAAgB;YAACY,QAAQ;QAAG;IACtF;IACA,MAAMC,UAAU,MAAMV,4BAA4BM;IAClD,IAAI,CAACI,SACH,MAAM,IAAIb,YAAY,kCAAkC,gBAAgB;QAACY,QAAQ;IAAG;IACtFb,+BAA+BS,SAAS;QACtCM,wBAAwBD,QAAQE,EAAE;QAClCC,kBAAkBH,QAAQG,gBAAgB;QAC1CC,eAAeJ,QAAQI,aAAa;IACtC;AACF"}

package/dist/presentation/auth/runner-registration-token-auth.d.ts

@@ -10,7 +10,11 @@ export type RunnerRegistrationContext = {
     workspaceId: string;
     provisionerId: string;
     reservationId: string | null;
-    provisionedRunnerId: string;
+    providerRunnerId: string;
+} | {
+    kind: 'activation';
+    activationTokenId: string;
+    workspaceId: string;
 };
 export declare function getRunnerContext(request: FastifyRequest): RunnerRegistrationContext;
 export declare function createRunnerRegistrationTokenAuthMethod(): AuthMethod;

package/dist/presentation/auth/runner-registration-token-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-registration-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/runner-registration-token-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AAEvF,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAM5C,MAAM,MAAM,yBAAyB,GACjC;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,yBAAyB,CAQnF;AAED,wBAAgB,uCAAuC,IAAI,UAAU,CAsEpE"}
+{"version":3,"file":"runner-registration-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/runner-registration-token-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AAGvF,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAU5C,MAAM,MAAM,yBAAyB,GACjC;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GACD;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC;AAEzE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,yBAAyB,CAQnF;AAED,wBAAgB,uCAAuC,IAAI,UAAU,CAoGpE"}

package/dist/presentation/auth/runner-registration-token-auth.js

@@ -1,8 +1,13 @@
 import { AUTH_RUNNER_REGISTRATION_TOKEN } from '@shipfox/api-auth-context';
 import { ClientError, extractBearerToken } from '@shipfox/node-fastify';
 import { getTokenType, hashOpaqueToken } from '@shipfox/node-tokens';
+import { and, eq, gt, isNull, or, sql } from 'drizzle-orm';
+import { db } from '#db/db.js';
 import { resolveEphemeralRegistrationTokenByHash } from '#db/ephemeral-registration-tokens.js';
 import { resolveManualRegistrationTokenByHash } from '#db/manual-registration-tokens.js';
+import { provisionerTokens } from '#db/schema/provisioner-tokens.js';
+import { runnerActivationTokens } from '#db/schema/runner-activation-tokens.js';
+import { providerRunners } from '#db/schema/runner-instances.js';
 const RUNNER_CONTEXT_KEY = 'runner';
 export function getRunnerContext(request) {
     const context = request[RUNNER_CONTEXT_KEY];
@@ -22,6 +27,21 @@ export function createRunnerRegistrationTokenAuthMethod() {
                 });
             }
             const tokenType = getTokenType(rawToken);
+            if (tokenType === 'runnerActivationToken') {
+                const [activation] = await db().select({
+                    id: runnerActivationTokens.id,
+                    workspaceId: providerRunners.workspaceId
+                }).from(runnerActivationTokens).innerJoin(providerRunners, eq(providerRunners.id, runnerActivationTokens.runnerInstanceId)).leftJoin(provisionerTokens, eq(provisionerTokens.id, providerRunners.provisionerId)).where(and(eq(runnerActivationTokens.hashedToken, hashOpaqueToken(rawToken)), isNull(runnerActivationTokens.consumedAt), isNull(runnerActivationTokens.revokedAt), gt(runnerActivationTokens.expiresAt, sql`now()`), or(isNull(provisionerTokens.id), isNull(provisionerTokens.revokedAt)), isNull(providerRunners.runnerSessionId))).limit(1);
+                if (!activation?.workspaceId) throw new ClientError('Invalid runner registration token', 'unauthorized', {
+                    status: 401
+                });
+                request[RUNNER_CONTEXT_KEY] = {
+                    kind: 'activation',
+                    activationTokenId: activation.id,
+                    workspaceId: activation.workspaceId
+                };
+                return;
+            }
             if (tokenType === 'ephemeralRegistrationToken') {
                 const ephemeralToken = await resolveEphemeralRegistrationTokenByHash(hashOpaqueToken(rawToken));
                 if (!ephemeralToken) {
@@ -40,7 +60,7 @@ export function createRunnerRegistrationTokenAuthMethod() {
                     workspaceId: ephemeralToken.workspaceId,
                     provisionerId: ephemeralToken.provisionerId,
                     reservationId: ephemeralToken.reservationId,
-                    provisionedRunnerId: ephemeralToken.provisionedRunnerId
+                    providerRunnerId: ephemeralToken.providerRunnerId
                 };
                 return;
             }